ServerName localhost DocumentRoot /var/www/html/public Options -Indexes +FollowSymLinks AllowOverride All Require all granted # Block direct access to sensitive paths Require all denied ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined # Security headers Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "SAMEORIGIN" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"